Cleartext storage of sensitive information in supportutils - CVE-2022-45154

Vulnerability identifier: #VU77143

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-45154

CWE-ID: CWE-312

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exist due to iSCSI passwords are stored in clear text in supportconfig archive. A local user can view the archive and extract iSCSI passwords from it.

supportutils
Dell EMC PowerProtect Data Protection
Dell Data Protection Central
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Enterprise Storage
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
openSUSE Leap
RecoverPoint for VMs
Dell EMC NetWorker vProxy

Install updates from vendor's website.

supportutils - addressed in versions 3.0.11-95.54.1, 3.1.26-150000.5.50.1, 3.1.26-150300.7.35.21.1
RecoverPoint for VMs - update to 6.0.SP1.P1
Dell EMC NetWorker vProxy - addressed in versions 19.8.0.3, 19.9.0.2

• https://bugzilla.suse.com/show_bug.cgi?id=1207598

• SUSE update for supportutils
• SUSE update for supportutils
• SUSE update for supportutils
• Multiple vulnerabilities in Dell Data Protection Central
• SUSE update for supportutils
• Multiple vulnerabilities in Dell NetWorker vProxy
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines